audit: prevent update of finalized proposals (#216)

* feat: prevent update of finalized proposals * chore renamed update proposal test * fix: update finalized propsal test --------- Co-authored-by: Orlando <[email protected]>
snapshot-labs · Jun 20, 2023 · 9f5f1fe · 9f5f1fe
1 parent 56409d5
commit 9f5f1fe
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/src/Space.sol b/src/Space.sol
@@ -313,6 +313,7 @@ contract Space is ISpace, Initializable, IERC4824, UUPSUpgradeable, OwnableUpgra
     ) external override onlyAuthenticator {
         Proposal storage proposal = proposals[proposalId];
         _assertProposalExists(proposal);
+        if (proposal.finalizationStatus != FinalizationStatus.Pending) revert ProposalFinalized();
         if (author != proposal.author) revert InvalidCaller();
         if (block.number >= proposal.startBlockNumber) revert VotingDelayHasPassed();
 

diff --git a/test/UpdateProposalMetadata.t.sol → test/UpdateProposal.t.sol b/test/UpdateProposalMetadata.t.sol → test/UpdateProposal.t.sol
@@ -63,6 +63,16 @@ contract UpdateProposalTest is SpaceTest {
         space.execute(proposalId, executionStrategy.params);
     }
 
+    function testUpdateFinalizedProposal() public {
+        uint256 proposalId = _createProposal(author, proposalMetadataURI, executionStrategy, new bytes(0));
+        vm.roll(block.number + votingDelay);
+        _vote(author, proposalId, Choice.For, userVotingStrategies, voteMetadataURI);
+        space.execute(proposalId, executionStrategy.params);
+
+        vm.expectRevert(abi.encodeWithSelector(ProposalFinalized.selector));
+        _updateProposal(author, proposalId, newStrategy, newMetadataURI);
+    }
+
     function testUpdateProposalAfterDelay() public {
         uint256 proposalId = _createProposal(author, proposalMetadataURI, executionStrategy, new bytes(0));
         vm.roll(block.number + votingDelay);